[Git][security-tracker-team/security-tracker][master] Add new node-handlebars issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
a473db02 by Salvatore Bonaccorso at 2026-10-07T10:49:36+02:00
Add new node-handlebars issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -341,11 +341,21 @@ CVE-2026-106448 (StableLib is a stable library of useful TypeScript and JavaScri
 CVE-2026-106447 (StableLib is a stable library of useful TypeScript and JavaScript code ...)
 	TODO: check
 CVE-2026-106446 (Handlebars provides the power necessary to let users build semantic te ...)
-	TODO: check
+	- node-handlebars <unfixed>
+	NOTE: https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj
+	NOTE: https://github.com/handlebars-lang/handlebars.js/pull/2185
+	NOTE: Fixed by: https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2 (v4.7.10)
+	NOTE: CVE exists because of a bypass of CVE-2026-33937
 CVE-2026-106445 (Handlebars provides the power necessary to let users build semantic te ...)
-	TODO: check
+	- node-handlebars <unfixed>
+	NOTE: https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f
+	NOTE: https://github.com/handlebars-lang/handlebars.js/pull/2185
+	NOTE: Fixed by: https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa (v4.7.10)
 CVE-2026-106444 (Handlebars provides the power necessary to let users build semantic te ...)
-	TODO: check
+	- node-handlebars <unfixed>
+	NOTE: https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xw65-4hp5-5hc7
+	NOTE: https://github.com/handlebars-lang/handlebars.js/pull/2185
+	NOTE: Fixed by: https://github.com/handlebars-lang/handlebars.js/commit/609d1b11c833c9a3e00f56f2f34d22f425446725 (v4.7.10)
 CVE-2026-106063 (A heap-based buffer overflow was found in GIMP\u2019s DICOM export plu ...)
 	TODO: check
 CVE-2026-106062 (A heap-based buffer overflow was found in GIMP\u2019s DirectDraw Surfa ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a473db0249555f2311f00df63575204ee429894d

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a473db0249555f2311f00df63575204ee429894d
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261007/7418f224/attachment-0001.htm>